Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule correlates the credential scraping phase with the invocation of zip, tar, or ditto to compress stolen artifacts into a single file in the /tmp directory. Specifically, it looks for these archiving utilities being executed with a command line that targets a .zip or .tar.gz file within /tmp, and joins this activity with the prior access of a file named 'Login Data' by the same initiating process.
Detects the loading of DLLs from suspicious locations such as AppData, Temp, or ProgramData into common browser processes. This activity is often associated with process injection techniques like Cobalt Strike's keylogging jobs or other credential theft attempts.
This rule monitors for the usage of the Windows API function 'SetWindowsHookEx' with the hook type 'WH_KEYBOARD_LL' (hook type 13), which is a common technique used by keyloggers and spyware to intercept keystrokes at the system level. The detection triggers when this API call is observed within process execution or API call traces.
Detects the Grixba infostealer (v1.5+) enumerating sensitive browser data (history, cookies, etc.) from multiple common web browsers. The rule monitors for file access events initiated by processes running from non-standard locations such as C:\Users\Public\Music\ or identified by specific .NET binary names associated with Grixba.
Detects the execution of 7-Zip (7za.exe) with specific command-line arguments that include a password, a specific data file (data2.bin), and references to Avast antivirus. This pattern is indicative of potential unauthorized data staging or decryption operations, possibly involving malicious archives intended to bypass security controls.
Detects suspicious unsigned processes that load user32.dll (often for API hooking) while concurrently writing data to files in temporary or application data directories (consistent with keylogging dump patterns). This rule targets non-system binaries originating from user-writable paths that exhibit combined module loading and file output behaviors typical of keylogger malware like TrymeLocker.
Detects OpenVPN Connect applying a server-controlled PAC AutoConfigURL to HKCU Internet Settings, potentially enabling proxy interception of user traffic. This is achieved when a malicious VPN server pushes a dhcp-option PROXY_AUTO_CONFIG_URL, causing the OpenVPN system-level agent to write the attacker-controlled URL to the user's registry hive.
Detects Hannibal Stealer reconnaissance activity involving the creation of a 'config.json' file within the 'SCef.WindowsAdapter' directory, correlated with suspicious process executions attempting to enumerate system information via 'GetComputerNameEx' or 'GetAdaptersInfo' API calls.
Detects queries extracting large contact lists or license details ($top=999 or $top=1000) via Microsoft Graph API, indicating automated data harvesting or reconnaissance activities. This behavior could be indicative of an adversary attempting to collect information about an organization's users or licensed software.
BirdCall Collects Clipboard Content
Cortex XDR
Detects an unsigned process using clipboard-related command-line or module indicators before writing local collection data. The rule specifically looks for process image names containing "bird", "call", "update", or "service" (case-insensitive) combined with command-line arguments or module indicators related to clipboard access such as "clipboard", "GetClipboardData", "OpenClipboard", or "CF_UNICODETEXT".
Detects a non-browser mailbox collection or archive utility connecting directly to an IP address while RemoteUrl is empty. This behavior is suspicious as legitimate email clients typically use hostnames. The rule filters out common browsers and svchost.exe and looks for keywords in the command line indicative of mailbox or archive activity (e.g., .pst, .ost, Aspose.Email, mailbox, archive). This suggests an attempt to exfiltrate or collect email data, potentially bypassing DNS resolution for C2 or evasion.
Detects HTTPS POST requests to known attacker-controlled infrastructure associated with the BadBlocker campaign (e.g., Unistream SDK, adblock-for-youtube domains). These requests often originate from browser extensions via injected scripts, facilitating the potential exfiltration of sensitive browser session data or credentials.
Detects behavior indicative of Bluekit Browser-in-the-Middle (AiTM) phishing, where a client system fetches the rrweb DOM-serialization library followed by the establishment of a WebSocket connection within a 5-minute window. This sequence is consistent with live session recording or interactive DOM streaming from an attacker-controlled infrastructure.
Detects PowerShell processes searching for .docx and .txt files in cloud sync directories.
Detects Browser-in-the-Middle (BitM) phishing attacks, such as Bluekit, that utilize the rrweb library for real-time DOM serialization and WebSocket streaming to capture user sessions. The rule correlates the presence of the rrweb library in HTTP traffic with WebSocket communication patterns containing session handshakes and serialized DOM payloads.
Detects screen capture behavior associated with the Turla group's STOCKSTAY/STOCKTRADER malware. The rule identifies a process running from the '%LOCALAPPDATA%/Programs/SMN/' directory generating multiple image files (png, bmp, jpg, jpeg), which is consistent with the malware's functionality of capturing and encoding screenshots for exfiltration.
Detects Browser-in-the-Middle (BitM) phishing infrastructure associated with PhaaS kits (e.g., Bluekit). The detection monitors proxy access logs for patterns where page assets (images, fonts, CSS) are fetched through a proxy API endpoint on behalf of the victim, combined with WebSocket connections used for real-time relay of victim inputs to the attacker.
Detects browser processes exhibiting a pattern consistent with 'Browser-in-the-Middle' attacks, specifically the streaming of DOM content (e.g., using rrweb) over persistent WebSocket connections to external IP addresses. The rule identifies high-density connection events to the same remote IP on port 443 lasting for more than 120 seconds and correlates these events with a preceding phishing email click on the same device.
Detects administrative mail, forwarding, or content compliance rule changes performed from an IP address classified as an anonymous proxy. This behavior is often associated with threat actors like UNC6508, who use obfuscation networks and proxies to access administrator accounts and exfiltrate data.
Detects the execution of known screen capture utilities or commands on Linux systems. This rule looks for processes named 'ffmpeg' or 'grim' and specific command-line arguments often associated with screen recording, such as 'x11grab', 'MJPEG', 'DISPLAY', 'XAUTHORITY', and 'WAYLAND_DISPLAY'. It also flags if the initiating process is 'node', 'systemd-userdbd', or 'npm', which could indicate suspicious activity.
Correlates the initial Fake Tech Support lure with the dropping of the secondary Havoc .exe or .dll payload into C:\Users\Public or %AppData%. This rule detects the creation of executable or DLL files in common public or user application data directories, specifically within 'C:\Users\Public' or 'C:\Users\<username>\AppData\Local', and correlates this file creation with a process that has '--kiosk' in its command line, which is often associated with browser-based lures.
Page 110 of 173